{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98837", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.372Z", "datePublished": "2026-10-18T15:50:05.338Z", "dateUpdated": "2026-10-30T12:40:06.606Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:06.606Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: unregister the input device when probe fails\n\nsetup_card() registers the input device, whose name and phys point into\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and\nsnd_usb_caiaq_control_init(). If either fails, snd_probe() calls\nsnd_card_free(), which frees the device state but leaves the input\ndevice registered: card_free() only clears the pointer, and the input\ndevice is unregistered from snd_disconnect() alone. Reading its \"uevent\"\nattribute afterwards dereferences freed memory:\n\n BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0\n Read of size 1 at addr ffff8880208f5043 by task caiaq/4967\n add_uevent_var+0x183/0x3a0\n input_dev_uevent+0x162/0x900\n dev_uevent+0x2f1/0x870\n uevent_show+0x1ca/0x3a0\n ...\n\nUnregister the input device on the probe error path, as\nsnd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when\nno input device was registered.\n\nReproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that\nmakes snd_usb_caiaq_control_init() fail."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/device.c"], "versions": [{"version": "da938aa9fc7826901921dcea225948ab21a97e45", "lessThan": "7017c9dda1ebbab428a6fd29c841596b5c9c84d1", "status": "affected", "versionType": "git"}, {"version": "09616e25f502080ba684fc7fcf959d1376ab756d", "lessThan": "8315ea07ebb2497531ff42dd640396f6f1d4a8f0", "status": "affected", "versionType": "git"}, {"version": "b956e48371f2ff72b76be9a829800ecec963bd45", "lessThan": "1d5d194594ff616ad36a052bde739d1cf5855b95", "status": "affected", "versionType": "git"}, {"version": "f537e3ad69609f6924a4db6b4a7f6561f5288bdd", "lessThan": "df2787819bd137111b56b8631dd581b0cce7144d", "status": "affected", "versionType": "git"}, {"version": "6251e3e256337a30160ef59ab1580dde4d1acd28", "lessThan": "850810c12686f80cdf7530f4f21e0157d904f739", "status": "affected", "versionType": "git"}, {"version": "e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056", "lessThan": "84727facd8506140cd04f2b0a8b1c4ddeac41cea", "status": "affected", "versionType": "git"}, {"version": "28abd224db4a49560b452115bca3672a20e45b2f", "lessThan": "2e5a413cc2a489c9427ecd3d73ad764bfb0c7103", "status": "affected", "versionType": "git"}, {"version": "28abd224db4a49560b452115bca3672a20e45b2f", "lessThan": "0b7bd20f6379bc5e431fd74d866390f5b5b63f3c", "status": "affected", "versionType": "git"}, {"version": "096dd8519cf2f768e9e14f224b627f7aaee1a9c5", "status": "affected", "versionType": "git"}, {"version": "5.10.258", "lessThan": "5.10.273", "status": "affected", "versionType": "semver"}, {"version": "5.15.209", "lessThan": "5.15.224", "status": "affected", "versionType": "semver"}, {"version": "6.1.175", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.140", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.86", "lessThan": "6.12.113", "status": "affected", "versionType": "semver"}, {"version": "6.18.27", "lessThan": "6.18.56", "status": "affected", "versionType": "semver"}, {"version": "7.0.4", "lessThan": "7.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/device.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.258", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.209", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.175", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.140", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.86", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.27", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7017c9dda1ebbab428a6fd29c841596b5c9c84d1"}, {"url": "https://git.kernel.org/stable/c/8315ea07ebb2497531ff42dd640396f6f1d4a8f0"}, {"url": "https://git.kernel.org/stable/c/1d5d194594ff616ad36a052bde739d1cf5855b95"}, {"url": "https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d"}, {"url": "https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739"}, {"url": "https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea"}, {"url": "https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103"}, {"url": "https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c"}], "title": "ALSA: caiaq: unregister the input device when probe fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/caiaq/device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7017c9dda1ebbab428a6fd29c841596b5c9c84d1", "status": "affected", "version": "da938aa9fc7826901921dcea225948ab21a97e45", "versionType": "git"}, {"lessThan": "8315ea07ebb2497531ff42dd640396f6f1d4a8f0", "status": "affected", "version": "09616e25f502080ba684fc7fcf959d1376ab756d", "versionType": "git"}, {"lessThan": "1d5d194594ff616ad36a052bde739d1cf5855b95", "status": "affected", "version": "b956e48371f2ff72b76be9a829800ecec963bd45", "versionType": "git"}, {"lessThan": "df2787819bd137111b56b8631dd581b0cce7144d", "status": "affected", "version": "f537e3ad69609f6924a4db6b4a7f6561f5288bdd", "versionType": "git"}, {"lessThan": "850810c12686f80cdf7530f4f21e0157d904f739", "status": "affected", "version": "6251e3e256337a30160ef59ab1580dde4d1acd28", "versionType": "git"}, {"lessThan": "84727facd8506140cd04f2b0a8b1c4ddeac41cea", "status": "affected", "version": "e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056", "versionType": "git"}, {"lessThan": "2e5a413cc2a489c9427ecd3d73ad764bfb0c7103", "status": "affected", "version": "28abd224db4a49560b452115bca3672a20e45b2f", "versionType": "git"}, {"lessThan": "0b7bd20f6379bc5e431fd74d866390f5b5b63f3c", "status": "affected", "version": "28abd224db4a49560b452115bca3672a20e45b2f", "versionType": "git"}, {"status": "affected", "version": "096dd8519cf2f768e9e14f224b627f7aaee1a9c5", "versionType": "git"}, {"lessThan": "5.10.273", "status": "affected", "version": "5.10.258", "versionType": "semver"}, {"lessThan": "5.15.224", "status": "affected", "version": "5.15.209", "versionType": "semver"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.175", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.140", "versionType": "semver"}, {"lessThan": "6.12.113", "status": "affected", "version": "6.12.86", "versionType": "semver"}, {"lessThan": "6.18.56", "status": "affected", "version": "6.18.27", "versionType": "semver"}, {"lessThan": "7.1", "status": "affected", "version": "7.0.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/caiaq/device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: unregister the input device when probe fails\n\nsetup_card() registers the input device, whose name and phys point into\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and\nsnd_usb_caiaq_control_init(). If either fails, snd_probe() calls\nsnd_card_free(), which frees the device state but leaves the input\ndevice registered: card_free() only clears the pointer, and the input\ndevice is unregistered from snd_disconnect() alone. Reading its \"uevent\"\nattribute afterwards dereferences freed memory:\n\n BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0\n Read of size 1 at addr ffff8880208f5043 by task caiaq/4967\n add_uevent_var+0x183/0x3a0\n input_dev_uevent+0x162/0x900\n dev_uevent+0x2f1/0x870\n uevent_show+0x1ca/0x3a0\n ...\n\nUnregister the input device on the probe error path, as\nsnd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when\nno input device was registered.\n\nReproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that\nmakes snd_usb_caiaq_control_init() fail."}], "id": "CVE-2026-98837", "lastModified": "2026-10-30T13:21:29.920", "metrics": {}, "published": "2026-10-18T16:17:37.943", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d5d194594ff616ad36a052bde739d1cf5855b95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7017c9dda1ebbab428a6fd29c841596b5c9c84d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8315ea07ebb2497531ff42dd640396f6f1d4a8f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: caiaq: unregister the input device when probe fails", "id": "2555232", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555232"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's ALSA caiaq USB audio driver. This flaw allows a local attacker to cause a Denial of Service (DoS) or potentially escalate privileges. When device initialization fails during the probing process, the driver frees internal device state structures while leaving the associated input device registered in the operating system. Accessing device attributes on this dangling input device subsequently triggers a use-after-free condition, leading to a system crash or kernel memory corruption."], "name": "CVE-2026-98837", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98837\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98837\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98837.mbox"], "threat_severity": "Moderate"}